forest_liana 9.22.14 → 9.22.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ea33256d7cec4221e9c94bbe46f8bc4f7caaef29854b237cff1961aed4809dd
-  data.tar.gz: c80925513502ae243fabd0d0c6840483634940882226ccb1e6c686c0cbc52553
+  metadata.gz: fc453faf72f6b0f7030087482ead90361fe6e3e16c4d2e7b25e2a53cbc1b5fe4
+  data.tar.gz: 6b13ab236bf05d9c5099cc8a987bd1616ecc7ba7097f077ffe3938674a428a75
 SHA512:
-  metadata.gz: f21a026ae94a6061ba804462b9e681dc4e43fa57ace54b627ca06fcec199d1ddbeebdbc701c94e4820d3e00de8bab105dc6acd3614db4f855318592b6957ab81
-  data.tar.gz: 0f8579fab129cd9ba90747c9c37a22de38bf4aa0bf89a210e4cee5a806129a9aee1b1adb5da22c8ede9925047478cf18fbceb79b394f5d5323b27f13a2e1ce08
+  metadata.gz: 48fac66a8b958fdf847c8861992d38f1a61efd8ff9df7da04d1254c5470246b684f0f584fd3881c80aff673f69284b115f0d44852f5eb97c62ba438c3f43dad2
+  data.tar.gz: fae68b2cf78f032cfef3a5609f9309631b69e0784b579cfc3dbe772b298c3202d5bd29a74d92796ee5610fa9b57443f80eb9bce2f8c910433a15ec67bdce2106

data/app/controllers/forest_liana/devise_controller.rb

@@ -1,11 +1,15 @@
 module ForestLiana
-  class DeviseController < ForestLiana::ApplicationController
-    def change_password
-      resource = SchemaUtils.find_model_from_collection_name(
-        params['data']['attributes']['collection_name'])
+  class DeviseController < ForestLiana::SmartActionsController
+    rescue_from ActiveRecord::RecordNotFound, with: :render_target_not_found
 
-      user = resource.find(params['data']['attributes']['ids'].first)
-      user.password = params['data']['attributes']['values']['New password']
+    def change_password
+      attributes = @parameters[:data][:attributes]
+      # The inherited scope check skips composite primary keys.
+      scoped_records = ForestLiana::ScopeManager.apply_scopes_on_records(
+        @resource, forest_user, ForestLiana.name_for(@resource), @parameters[:timezone]
+      )
+      user = scoped_records.find(attributes[:ids].first)
+      user.password = attributes[:values]['New password']
       user.save
 
       if user.valid?
@@ -16,6 +20,11 @@ module ForestLiana
         }
       end
     end
+
+    private
+
+    def render_target_not_found
+      render serializer: nil, json: { error: 'Smart Action: target record not found' }, status: :bad_request
+    end
   end
 end
-

data/app/controllers/forest_liana/smart_actions_controller.rb

@@ -6,11 +6,13 @@ module ForestLiana
     rescue_from ForestLiana::Ability::Exceptions::ActionConditionError, with: :render_error
     include ForestLiana::Ability
     if Rails::VERSION::MAJOR < 4
+      before_filter :refuse_requester_id_outside_signed_request
       before_filter :get_smart_action_request
       before_filter :find_resource
       before_filter :check_permission_for_smart_route
       before_filter :ensure_record_ids_in_scope
     else
+      before_action :refuse_requester_id_outside_signed_request
       before_action :get_smart_action_request
       before_action :find_resource
       before_action :check_permission_for_smart_route
@@ -19,6 +21,10 @@ module ForestLiana
 
     private
 
+    def refuse_requester_id_outside_signed_request
+      raise ForestLiana::Errors::HTTP422Error.new if params.dig(:data, :attributes, :requester_id)
+    end
+
     def get_smart_action_request
       begin
         params[:data][:attributes]

data/app/controllers/forest_liana/stripe_controller.rb

@@ -1,5 +1,12 @@
 module ForestLiana
   class StripeController < ForestLiana::ApplicationController
+    include ForestLiana::Ability
+
+    rescue_from ForestLiana::Ability::Exceptions::TriggerForbidden, with: :render_error
+    rescue_from ForestLiana::Ability::Exceptions::RequireApproval, with: :render_error
+    rescue_from ForestLiana::Ability::Exceptions::UnsupportedConditionals, with: :render_error
+
+    before_action :authorize_refund, only: :refund
 
     def payments
       getter = StripePaymentsGetter.new(params, request.headers['Stripe-Secret-Key'],
@@ -27,7 +34,7 @@ module ForestLiana
 
     def refund
       begin
-        refunder = StripePaymentRefunder.new(params)
+        refunder = StripePaymentRefunder.new(@refund_parameters)
         refunder.perform
 
         render serializer: nil, json: {}
@@ -137,5 +144,24 @@ module ForestLiana
     def get_serializer_type(suffix)
       "#{params[:collection]}_#{suffix}"
     end
+
+    private
+
+    def authorize_refund
+      raise ForestLiana::Errors::HTTP422Error.new if params.dig(:data, :attributes, :requester_id).present?
+
+      parameters = refund_request_parameters
+      collection_name = parameters.dig(:data, :attributes, :collection_name).to_s
+      is_integration_action_authorized?(forest_user, collection_name, 'Refund', params)
+      @refund_parameters = parameters
+    end
+
+    def refund_request_parameters
+      return params.permit! unless params.dig(:data, :attributes, :signed_approval_request)
+
+      ForestLiana::Ability::Permission::RequestPermission.decodeSignedApprovalRequest(params.permit!)
+    rescue JWT::DecodeError
+      raise ForestLiana::Errors::HTTP400Error.new('Invalid signed action parameters')
+    end
   end
 end

data/app/services/forest_liana/ability/exceptions/unsupported_conditionals.rb

@@ -0,0 +1,17 @@
+module ForestLiana
+  module Ability
+    module Exceptions
+      class UnsupportedConditionals < ForestLiana::Errors::ExpectedError
+        def initialize(backtrace = nil)
+          super(
+            422,
+            :unprocessable_entity,
+            'The roles conditions (conditional smart actions) are not supported with Smart Collection. Please contact an administrator.',
+            'UnsupportedConditionalsFeatureError',
+            backtrace
+          )
+        end
+      end
+    end
+  end
+end

data/app/services/forest_liana/ability/permission/smart_action_checker.rb

@@ -43,7 +43,7 @@ module ForestLiana
           elsif @smart_action['approvalRequired'].include?(@user['roleId'])
             if condition_by_role_id(@smart_action['approvalRequiredConditions']).blank? || match_conditions('approvalRequiredConditions')
               # Global actions target no specific records — never resolve.
-              if @parameters[:data][:attributes][:all_records] && @action_type != 'global'
+              if @parameters[:data][:attributes][:all_records] && @action_type != 'global' && @collection
                 record_ids = select_all_record_ids
               end
 
@@ -83,6 +83,8 @@ module ForestLiana
         end
 
         def match_conditions(condition_name)
+          raise ForestLiana::Ability::Exceptions::UnsupportedConditionals.new unless @collection
+
           begin
             attributes = @parameters[:data][:attributes]
             condition = condition_by_role_id(@smart_action[condition_name])

data/app/services/forest_liana/ability/permission.rb

@@ -53,6 +53,19 @@ module ForestLiana
         end
       end
 
+      # An integration collection (`<Model>_stripe_payments`, …) has no model: a select-all is not
+      # resolved for its approval, and a role condition on its action is refused as unsupported.
+      def is_integration_action_authorized?(user, collection_name, action_name, parameters)
+        return true unless has_permission_system?
+
+        schema_action = find_integration_action(collection_name, action_name)
+        user_data = get_user_data(user['id'])
+        smart_action = schema_action && get_collections_permissions_data.dig(collection_name, :actions, action_name)
+        raise ForestLiana::Ability::Exceptions::TriggerForbidden.new unless user_data && smart_action
+
+        SmartActionChecker.new(parameters, nil, smart_action, user_data, schema_action.type, user).can_execute?
+      end
+
       # +refetch+ drops the cached permissions first. Only a caller about to refuse on a denial asks
       # for it (a stale, up to TTL-old cache may sit behind a permission granted moments ago): the
       # refetch rewrites the cluster-wide `forest.collections` entry and this request's copy, so a
@@ -367,6 +380,12 @@ module ForestLiana
         nil
       end
 
+      def find_integration_action(collection_name, action_name)
+        collection = ForestLiana.apimap.find { |candidate| candidate.name.to_s == collection_name && candidate.integration.present? }
+
+        collection&.actions&.find { |action| action.name == action_name }
+      end
+
       def find_action_from_endpoint(collection_name, endpoint, http_method)
         collection = ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }
 

data/app/services/forest_liana/schema_adapter.rb

@@ -32,6 +32,7 @@ module ForestLiana
         collection.actions << ForestLiana::Model::Action.new({
           id: "#{collection.name}.Change password",
           name: "Change password",
+          type: 'single',
           fields: [{
             field: 'New password',
             type: 'String'

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.14"
+  VERSION = "9.22.16"
 end

data/spec/requests/actions_controller_spec.rb

@@ -563,6 +563,17 @@ describe 'Requesting Actions routes', :type => :request  do
       end
     end
 
+    describe 'with a requester named outside a signed approval request' do
+      it 'should respond 422 and NOT perform the action' do
+        params[:data][:attributes][:requester_id] = 99
+        expect_any_instance_of(Forest::IslandsController).not_to receive(:test)
+
+        post '/forest/actions/test', params: JSON.dump(params), headers: headers
+
+        expect(response.status).to eq(422)
+      end
+    end
+
     describe 'with scopes' do
       before(:each) do
         allow_any_instance_of(ForestLiana::Ability).to receive(:forest_authorize!) { true }

data/spec/requests/devise_controller_spec.rb

@@ -0,0 +1,271 @@
+require 'rails_helper'
+
+describe 'Change password action', type: :request do
+  let(:rendering_id) { 13 }
+  let(:role_id) { 1 }
+  let(:trigger_roles) { [role_id] }
+  let(:approval_roles) { [] }
+  let(:approver_roles) { [] }
+  let(:scope_filters) { { 'scopes' => {}, 'team' => { 'id' => '1', 'name' => 'Operations' } } }
+  let(:cache) { ActiveSupport::Cache::MemoryStore.new }
+  let(:island_collection) { ForestLiana.apimap.find { |collection| collection.name.to_s == 'Island' } }
+  let(:change_password_action) do
+    ForestLiana::Model::Action.new(
+      id: 'Island.Change password',
+      name: 'Change password',
+      type: 'single',
+      fields: [{ field: 'New password', type: 'String' }]
+    )
+  end
+
+  let(:token) do
+    JWT.encode({
+      id: 38,
+      email: 'michael.kelso@that70.show',
+      first_name: 'Michael',
+      last_name: 'Kelso',
+      team: 'Operations',
+      rendering_id: rendering_id,
+      exp: Time.now.to_i + 2.weeks.to_i,
+      permission_level: 'user'
+    }, ForestLiana.auth_secret, 'HS256')
+  end
+
+  let(:headers) do
+    {
+      'Accept' => 'application/json',
+      'Content-Type' => 'application/json',
+      'Authorization' => "Bearer #{token}"
+    }
+  end
+
+  let(:attributes) do
+    {
+      collection_name: 'Island',
+      ids: ['1'],
+      all_records: false,
+      values: { 'New password' => 'n3w-p4ssw0rd' },
+      smart_action_id: 'Island-Change password'
+    }
+  end
+
+  let(:params) { { data: { attributes: attributes, type: 'custom-action-requests' }, timezone: 'Europe/Paris' } }
+
+  def environment_permissions
+    enabled = { 'roles' => [role_id] }
+    crud = %w[browseEnabled readEnabled editEnabled addEnabled deleteEnabled exportEnabled].to_h { |key| [key, enabled] }
+    change_password = {
+      'triggerEnabled' => { 'roles' => trigger_roles },
+      'triggerConditions' => [],
+      'approvalRequired' => { 'roles' => approval_roles },
+      'approvalRequiredConditions' => [],
+      'userApprovalEnabled' => { 'roles' => approver_roles },
+      'userApprovalConditions' => [],
+      'selfApprovalEnabled' => { 'roles' => [] }
+    }
+
+    { 'collections' => { 'Island' => { 'collection' => crud, 'actions' => { 'Change password' => change_password } } } }
+  end
+
+  before(:all) { Island.send(:attr_accessor, :password) }
+  after(:all) { Island.send(:remove_method, :password, :password=) }
+
+  before do
+    island_collection.actions << change_password_action
+    Island.create!(id: 1, name: 'Corsica')
+
+    allow(Rails).to receive(:cache).and_return(cache)
+    allow_any_instance_of(ForestLiana::Ability::Fetch).to receive(:get_permissions) do |_, path|
+      case path
+      when '/liana/v4/permissions/environment' then environment_permissions
+      when '/liana/v4/permissions/users' then [{ 'id' => 38, 'roleId' => role_id }]
+      end
+    end
+
+    ForestLiana::ScopeManager.invalidate_scope_cache(rendering_id)
+    allow(ForestLiana::ScopeManager).to receive(:fetch_scopes).and_return(scope_filters)
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+  end
+
+  after do
+    island_collection.actions.delete(change_password_action)
+    Island.destroy_all
+  end
+
+  def change_password
+    post '/forest/actions/change-password', params: JSON.dump(params), headers: headers
+  end
+
+  context 'when the user is allowed to trigger the action on the collection' do
+    it 'responds 204 and sets the new password on the targeted record' do
+      expect_any_instance_of(Island).to receive(:password=).with('n3w-p4ssw0rd').and_call_original
+
+      change_password
+
+      expect(response.status).to eq(204)
+    end
+  end
+
+  context 'when the user scope excludes the targeted record at lookup' do
+    it 'resolves the record within the user scope and leaves the password unchanged' do
+      expect(ForestLiana::ScopeManager).to receive(:apply_scopes_on_records)
+        .with(Island, hash_including('id' => 38, 'rendering_id' => rendering_id), 'Island', 'Europe/Paris')
+        .and_return(Island.none)
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)).to eq('error' => 'Smart Action: target record not found')
+    end
+  end
+
+  context 'when the user is not allowed to trigger the action on the collection' do
+    let(:trigger_roles) { [] }
+
+    it 'responds 403 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first).to include(
+        'name' => 'CustomActionTriggerForbiddenError',
+        'detail' => "You don't have the permission to trigger this action"
+      )
+    end
+  end
+
+  context 'when the user role must have the action approved' do
+    let(:approval_roles) { [role_id] }
+
+    it 'responds 403 asking for approval and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first).to include(
+        'name' => 'CustomActionRequiresApprovalError',
+        'detail' => 'This action requires to be approved.'
+      )
+    end
+  end
+
+  context 'when the request carries no smart action id' do
+    let(:attributes) { super().except(:smart_action_id) }
+
+    it 'responds 400 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+    end
+  end
+
+  context 'when the targeted record is outside the user scope' do
+    let(:scope_filters) do
+      {
+        'scopes' => {
+          'Island' => {
+            'aggregator' => 'and',
+            'conditions' => [{ 'field' => 'name', 'operator' => 'equal', 'value' => 'Ré' }]
+          }
+        },
+        'team' => { 'id' => 43, 'name' => 'Operations' }
+      }
+    end
+
+    it 'responds 400 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)).to eq('error' => 'Smart Action: target record not found')
+    end
+  end
+
+  context 'when the request selects all records' do
+    let(:attributes) { super().merge(all_records: true, all_records_ids_excluded: []) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+      expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+    end
+  end
+
+  context 'when the request targets several records' do
+    let(:attributes) { super().merge(ids: %w[1 2]) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+      expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+    end
+  end
+
+  context 'when the request names a requester outside a signed approval request' do
+    let(:attributes) { super().merge(requester_id: 99) }
+
+    it 'responds 422 and leaves the password unchanged' do
+      expect_any_instance_of(Island).not_to receive(:password=)
+
+      change_password
+
+      expect(response.status).to eq(422)
+    end
+  end
+
+  context 'when an approver executes a signed approval request' do
+    let(:approval_roles) { [role_id] }
+    let(:approver_roles) { [role_id] }
+    let(:approved_ids) { ['1'] }
+    let(:signed_approval_request) do
+      JWT.encode(
+        { data: { attributes: attributes.merge(ids: approved_ids, requester_id: 99) } },
+        ForestLiana.env_secret,
+        'HS256'
+      )
+    end
+    let(:params) do
+      {
+        data: {
+          attributes: attributes.except(:values).merge(signed_approval_request: signed_approval_request),
+          type: 'custom-action-requests'
+        },
+        timezone: 'Europe/Paris'
+      }
+    end
+
+    it 'responds 204 and sets the approved password on the targeted record' do
+      expect_any_instance_of(Island).to receive(:password=).with('n3w-p4ssw0rd').and_call_original
+
+      change_password
+
+      expect(response.status).to eq(204)
+    end
+
+    context 'and the approved request targets several records' do
+      let(:approved_ids) { %w[1 2] }
+
+      it 'responds 422 and leaves the password unchanged' do
+        expect_any_instance_of(Island).not_to receive(:password=)
+
+        change_password
+
+        expect(response.status).to eq(422)
+        expect(JSON.parse(response.body)['errors'].first).to include('detail' => ForestLiana::SingleRecordSelection::MESSAGE)
+      end
+    end
+  end
+end

data/spec/requests/stripe_refund_spec.rb

@@ -0,0 +1,292 @@
+require 'rails_helper'
+
+describe 'Stripe payments refund', type: :request do
+  let(:rendering_id) { 13 }
+  let(:user_id) { 38 }
+  let(:role_id) { 1 }
+  let(:approver_role_id) { 3 }
+  let(:trigger_roles) { [role_id] }
+  let(:approval_roles) { [] }
+  let(:user_approval_roles) { [] }
+  let(:trigger_conditions) { [] }
+  let(:permissions_users) { [{ 'id' => user_id, 'roleId' => role_id }] }
+  let(:has_permission_system) { true }
+  let(:cache) { ActiveSupport::Cache::MemoryStore.new }
+  let(:refunder) { instance_double(ForestLiana::StripePaymentRefunder, perform: nil) }
+  let(:refund_requests) { [] }
+  let(:payments_collection) do
+    ForestLiana::Model::Collection.new(
+      name: 'Island_stripe_payments',
+      integration: 'stripe',
+      is_virtual: true,
+      actions: [ForestLiana::Model::Action.new(name: 'Refund', endpoint: '/forest/stripe_payments/refunds')]
+    )
+  end
+
+  let(:token) do
+    JWT.encode({
+      id: user_id,
+      email: 'michael.kelso@that70.show',
+      first_name: 'Michael',
+      last_name: 'Kelso',
+      team: 'Operations',
+      rendering_id: rendering_id,
+      exp: Time.now.to_i + 2.weeks.to_i,
+      permission_level: 'user'
+    }, ForestLiana.auth_secret, 'HS256')
+  end
+
+  let(:headers) do
+    {
+      'Accept' => 'application/json',
+      'Content-Type' => 'application/json',
+      'Authorization' => "Bearer #{token}"
+    }
+  end
+
+  let(:attributes) do
+    {
+      collection_name: 'Island_stripe_payments',
+      ids: ['ch_1', 'ch_2'],
+      values: {},
+      all_records: false,
+      smart_action_id: 'Island_stripe_payments-Refund'
+    }
+  end
+
+  let(:params) { { data: { attributes: attributes, type: 'custom-action-requests' }, timezone: 'Europe/Paris' } }
+
+  def environment_permissions
+    enabled = { 'roles' => [role_id, approver_role_id] }
+    crud = %w[browseEnabled readEnabled editEnabled addEnabled deleteEnabled exportEnabled].to_h { |key| [key, enabled] }
+    refund = {
+      'triggerEnabled' => { 'roles' => trigger_roles },
+      'triggerConditions' => trigger_conditions,
+      'approvalRequired' => { 'roles' => approval_roles },
+      'approvalRequiredConditions' => [],
+      'userApprovalEnabled' => { 'roles' => user_approval_roles },
+      'userApprovalConditions' => [],
+      'selfApprovalEnabled' => { 'roles' => [] }
+    }
+
+    { 'collections' => { 'Island_stripe_payments' => { 'collection' => crud, 'actions' => { 'Refund' => refund } } } }
+  end
+
+  def signed_approval_request(ids:, requester_id:)
+    JWT.encode({
+      data: {
+        attributes: attributes.merge(ids: ids, requester_id: requester_id),
+        type: 'custom-action-requests'
+      }
+    }, ForestLiana.env_secret, 'HS256')
+  end
+
+  def refund(request_headers = headers)
+    post '/forest/stripe_payments/refunds', params: JSON.dump(params), headers: request_headers
+  end
+
+  def refunded_ids
+    refund_requests.map { |refund_params| refund_params[:data][:attributes][:ids] }
+  end
+
+  before do
+    ForestLiana.apimap << payments_collection
+
+    allow(Rails).to receive(:cache).and_return(cache)
+    allow_any_instance_of(ForestLiana::Ability::Fetch).to receive(:get_permissions) do |_, path|
+      case path
+      when '/liana/v4/permissions/environment' then has_permission_system ? environment_permissions : true
+      when '/liana/v4/permissions/users' then permissions_users
+      end
+    end
+
+    allow(ForestLiana::StripePaymentRefunder).to receive(:new) do |refund_params|
+      refund_requests << refund_params
+      refunder
+    end
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+  end
+
+  after { ForestLiana.apimap.delete(payments_collection) }
+
+  context 'when the role is allowed to trigger the Refund action' do
+    it 'responds 200 and refunds each requested charge' do
+      refund
+
+      expect(response.status).to eq(200)
+      expect(refunded_ids).to eq([['ch_1', 'ch_2']])
+      expect(refunder).to have_received(:perform).with(no_args)
+    end
+  end
+
+  context 'when the project has no permission system' do
+    let(:has_permission_system) { false }
+    let(:trigger_roles) { [] }
+
+    it 'responds 200 and refunds each requested charge' do
+      refund
+
+      expect(response.status).to eq(200)
+      expect(refunded_ids).to eq([['ch_1', 'ch_2']])
+    end
+  end
+
+  context 'when the role is not allowed to trigger the Refund action' do
+    let(:trigger_roles) { [approver_role_id] }
+
+    it 'responds 403 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first['name']).to eq('CustomActionTriggerForbiddenError')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the user is no longer in the permissions system' do
+    let(:permissions_users) { [] }
+
+    it 'responds 403 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the Refund action requires approval for the role' do
+    let(:approval_roles) { [role_id] }
+    let(:user_approval_roles) { [approver_role_id] }
+
+    it 'responds 403 with the roles allowed to approve and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      error = JSON.parse(response.body)['errors'].first
+      expect(error['name']).to eq('CustomActionRequiresApprovalError')
+      expect(error['data']).to eq('roleIdsAllowedToApprove' => [approver_role_id])
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when an approver sends a signed approval request' do
+    let(:role_id) { approver_role_id }
+    let(:trigger_roles) { [] }
+    let(:user_approval_roles) { [approver_role_id] }
+    let(:attributes) do
+      super().merge(ids: ['ch_99'], signed_approval_request: signed_approval_request(ids: ['ch_1'], requester_id: 12))
+    end
+
+    it 'responds 200 and refunds the charges of the approved request' do
+      refund
+
+      expect(response.status).to eq(200)
+      expect(refunded_ids).to eq([['ch_1']])
+    end
+  end
+
+  context 'when the approval request is not signed with the environment secret' do
+    let(:role_id) { approver_role_id }
+    let(:trigger_roles) { [] }
+    let(:user_approval_roles) { [approver_role_id] }
+    let(:attributes) do
+      forged = JWT.encode({ data: { attributes: { collection_name: 'Island_stripe_payments', ids: ['ch_1'], requester_id: 12 } } }, 'another-secret', 'HS256')
+      super().merge(signed_approval_request: forged)
+    end
+
+    it 'responds 400 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)['errors'].first['detail']).to eq('Invalid signed action parameters')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the body carries a requester id outside a signed approval request' do
+    let(:attributes) { super().merge(requester_id: 12) }
+
+    it 'responds 422 and refunds nothing, even for a role allowed to trigger the Refund action' do
+      refund
+
+      expect(response.status).to eq(422)
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the role can trigger the Refund action only under a condition' do
+    let(:trigger_conditions) do
+      [{ 'roleId' => role_id, 'filter' => { 'field' => 'amount', 'operator' => 'greater_than', 'value' => 0, 'source' => 'data' } }]
+    end
+
+    it 'responds 422 and refunds nothing, since role conditions are not supported on Stripe payments' do
+      refund
+
+      expect(response.status).to eq(422)
+      expect(JSON.parse(response.body)['errors'].first['name']).to eq('UnsupportedConditionalsFeatureError')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when a role needing approval selects every payment' do
+    let(:approval_roles) { [role_id] }
+    let(:user_approval_roles) { [approver_role_id] }
+    let(:attributes) { super().merge(all_records: true, all_records_ids_excluded: []) }
+
+    it 'responds 403 with the roles allowed to approve and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      error = JSON.parse(response.body)['errors'].first
+      expect(error['name']).to eq('CustomActionRequiresApprovalError')
+      expect(error['data']).to eq('roleIdsAllowedToApprove' => [approver_role_id])
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the request names a collection without the Stripe Refund action' do
+    let(:attributes) { super().merge(collection_name: 'Island') }
+
+    it 'responds 403 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first['name']).to eq('CustomActionTriggerForbiddenError')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the request names no collection' do
+    let(:attributes) { super().except(:collection_name) }
+
+    it 'responds 403 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first['name']).to eq('CustomActionTriggerForbiddenError')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the project has no permission system and the request names no collection' do
+    let(:has_permission_system) { false }
+    let(:attributes) { super().except(:collection_name) }
+
+    it 'responds 200 and refunds each requested charge' do
+      refund
+
+      expect(response.status).to eq(200)
+      expect(refunded_ids).to eq([['ch_1', 'ch_2']])
+    end
+  end
+
+  context 'when the request is not authenticated' do
+    it 'responds 401 and refunds nothing' do
+      refund(headers.except('Authorization'))
+
+      expect(response.status).to eq(401)
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+end

data/spec/services/forest_liana/schema_adapter_spec.rb

@@ -122,6 +122,32 @@ module ForestLiana
           expect(uri_regex_validation[:value].match('\n')).to eq(nil)
         end
       end
+
+      context 'with a Devise model' do
+        let(:devise_model) do
+          stub_const('DeviseAccount', Class.new(ActiveRecord::Base) do
+            self.table_name = 'isle'
+
+            def self.devise_modules?
+              true
+            end
+          end)
+        end
+
+        after { ForestLiana.apimap.delete_if { |collection| collection.name.to_s == 'DeviseAccount' } }
+
+        it 'declares Change password as a single-record action' do
+          collection = described_class.new(devise_model).perform
+          action = collection.actions.find { |candidate| candidate.name == 'Change password' }
+
+          expect(action).to have_attributes(
+            id: 'DeviseAccount.Change password',
+            type: 'single',
+            endpoint: 'forest/actions/change-password',
+            http_method: 'POST'
+          )
+        end
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.14
+  version: 9.22.16
 platform: ruby
 authors:
 - Sandro Munda
@@ -286,6 +286,7 @@ files:
 - app/services/forest_liana/ability/exceptions/unauthorized_query_field_error.rb
 - app/services/forest_liana/ability/exceptions/unexposed_query_collection_error.rb
 - app/services/forest_liana/ability/exceptions/unknown_collection.rb
+- app/services/forest_liana/ability/exceptions/unsupported_conditionals.rb
 - app/services/forest_liana/ability/fetch.rb
 - app/services/forest_liana/ability/permission.rb
 - app/services/forest_liana/ability/permission/request_permission.rb
@@ -486,6 +487,7 @@ files:
 - spec/requests/capabilities_spec.rb
 - spec/requests/cors_spec.rb
 - spec/requests/count_spec.rb
+- spec/requests/devise_controller_spec.rb
 - spec/requests/missing_attribute_valve_spec.rb
 - spec/requests/permissions_cache_footprint_spec.rb
 - spec/requests/projection_header_spec.rb
@@ -497,6 +499,7 @@ files:
 - spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
+- spec/requests/stripe_refund_spec.rb
 - spec/requests/test.ru
 - spec/requests/unresolved_polymorphic_relation_spec.rb
 - spec/requests/workflow_executions_spec.rb
@@ -850,6 +853,7 @@ test_files:
 - spec/requests/capabilities_spec.rb
 - spec/requests/cors_spec.rb
 - spec/requests/count_spec.rb
+- spec/requests/devise_controller_spec.rb
 - spec/requests/missing_attribute_valve_spec.rb
 - spec/requests/permissions_cache_footprint_spec.rb
 - spec/requests/projection_header_spec.rb
@@ -861,6 +865,7 @@ test_files:
 - spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
+- spec/requests/stripe_refund_spec.rb
 - spec/requests/test.ru
 - spec/requests/unresolved_polymorphic_relation_spec.rb
 - spec/requests/workflow_executions_spec.rb